# vh on nh3-albok as the operator's albok viewer (Prime, 2026-10-09: "vh gets albok-everything").
#   scripts/elway infra-ops@10.100.50.44 --playbook playbooks/nh3-albok-vh-viewer.yaml --var keys_file=<local .pub list>
# Idempotent. Joins vh to every albok read group that exists (albok-read 1510 = fleet + library,
# albok-personal 1511 = personal/notes, albok-feedback 1512 = personal/agent-feedback, which had been
# default-deny until this ruling) and authorizes the operator's workstation public keys for vh, so a
# workstation can sshfs-mount a wing's .browse/ (see stacks/albok-service/README.md).
# A later restricted group (1513+, e.g. the vault wing) is NOT included: add it here deliberately.
# Group membership is read at login, so it applies to new SSH sessions only.
vars:
  keys_file: ""
  groups: albok-read,albok-personal,albok-feedback

steps:
  - name: vh joins {{ groups }}
    sudo: true
    shell: usermod -aG {{ groups }} vh
    when: "! (for g in $(echo {{ groups }} | tr , ' '); do id -nG vh | tr ' ' '\\n' | grep -qx \"$g\" || exit 1; done)"

  - name: stage the workstation public keys
    upload:
      src: "{{ keys_file }}"
      dest: /tmp/vh-workstation-keys.pub
      mode: "0644"

  - name: append each key to vh's authorized_keys if absent
    sudo: true
    shell: |
      set -e
      added=0
      while IFS= read -r k; do
        [ -n "$k" ] || continue
        grep -qxF "$k" /home/vh/.ssh/authorized_keys || { printf '%s\n' "$k" >> /home/vh/.ssh/authorized_keys; added=$((added+1)); }
      done < /tmp/vh-workstation-keys.pub
      rm -f /tmp/vh-workstation-keys.pub
      echo "added $added"

verify:
  - name: vh holds every group
    shell: |
      for g in $(echo {{ groups }} | tr , ' '); do
        id -nG vh | tr ' ' '\n' | grep -qx "$g" || { echo "missing $g"; exit 1; }
      done
    changed_when: "false"
  - name: authorized_keys still vh-owned and 600
    sudo: true
    shell: test "$(stat -c '%U %a' /home/vh/.ssh/authorized_keys)" = "vh 600"
    changed_when: "false"